CVE-2026-87902
HIGHCVSS 3.1 · 8.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CISA KEV: known exploited
Added: 2026-09-25 · Due: 2026-09-28
Known ransomware use: Unknown
EPSS: 95.77% · Percentile: 99.9%
As of 2026-10-27
EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.
CWE: CWE-98 · Published: 2026-09-22T17:17:28.310 · Modified: 2026-09-28T12:20:54.040
Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.